End User Applications,

Including Spreadsheets

Sion Wyn

Conformity

+[44] (0) 1492 642622

sion.wyn@conform-it.com

2

GAMP

Document

Structure

3

GAMP 5 Appendices

GAMP5 Main Body

Management Appendices (M1-M10)

Development Appendices (D1-D7)

Special Interest Topics (S1-S6)

Operation Appendices (O1-O13)

General Appendices (G1-G3)

4

Special Interest Topics Appendices

• S1 Alignment with ASTM E2500

• S2 Electronic Production Records (EPR)

• S3 End User Applications including

Spreadsheets

• S4 Patch Management

• S5 Managing Quality within an Outsourced

IS/IT Environment

• S6 Organizational Change

5

One Example….

• S3 End User Applications Including

Spreadsheets

• (…and covering other applications such as

user developed small databases…)

6

Why a ‘Hot Topic’?

• Often under-estimated and under-

documented

• Difficult to detect and control

• Easy to develop

• Can be very powerful

• Can have high GxP Risk

Regulatory Examples

• FDA Warning Letter (1)

– “Failure to use fully validated spreadsheets to

calculate analytical results for in-process and

finished product testing [21 CFR 211.165(e)].”

Regulatory Examples

• FDA Warning Letter (2)

– “There is no documentation covering Excel

application software, or any procedures

instituted covering the protection of electronic

records or an established back-up system.”

Regulatory Examples

• FDA Warning Letter (3)

• Failure to manage laboratory systems

with sufficient controls to ensure

conformance to established

specifications and prevent omission of

data.

• Serious deficiencies related to your

documentation practices, including

missing raw data.

Continues…

Regulatory Examples

• FDA Warning Letter (3) continued…

• Use of uncontrolled worksheets for raw

analytical data in your laboratory.

• Presence of many uncontrolled

chromatograms, spreadsheets and

notes of unknown origin found in a

drawer.

Spreadsheets

• Important quality decisions are sometimes based on

uncontrolled spreadsheets

No clear requirements

No verification of correct operation

No security of data.

Spreadsheets

• They are sometimes used as an electronic form of a

GxP record.

• In such cases it is difficult to ensure the required level

of security and integrity without external means, such

as:

File locking

Procedures

Document management solutions

• ...to add security

Many Uses...

1. Generate paper records

2. Templates/repository for information

3. Basis of an application

• For 1 and 2, the main concern is data

integrity

External controls, such as a document

management solution should be considered

Data Integrity Issues

• Multiple copies

• Where is the master record?

• Who has access?

• What can they do:

Deliberately?

By Mistake?

• Some will be regulated records

Accuracy and Reliability

• Correct requirements

• Correct algorithms

• Correct programming

• Referring to the correct field(s)

• Using the right standard function?

• Is the standard function right? (e.g.

precision, accuracy)

16

How to proceed?

• Gamp 5 principles apply:

Apply lifecycle, manage, and control

according to:

– requirements for safety, quality, integrity

– complexity and novelty

Specify and verify

Apply the right security measures

Manage under change control

Same Process...

• Plan the process

• Define Requirements

• Translate into a solution

• Verify requirements are met

• Document the process

Plan Specify Test Report

18

Complexity and Risk

Low Medium High

Complexity of End-User Application

Se

veri

ty o

f Im

pa

ct

on

Pati

en

t S

afe

ty

HighSevere potential harm to patients,

(e.g. death, hospitalization, long term effects)

MediumMinor, short term effect on patients

LowNo significant impact on patients

None

19

Examples…

1. Simple spreadsheet (Content

Uniformity) calculations)

URS, calculation verification, security

2. Training attendance spreadsheet

Document controls , no specific validation

3. Clinical study statistical analysis with VBA macros

Full Category 5 approach recommended

Low Medium High

Complexity of End-User Application

Se

veri

ty o

f Im

pa

ct

on

Pati

en

t S

afe

ty

HighSevere potential harm to patients,

(e.g. death, hospitalization, long term effects)

MediumMinor, short term effect on patients

LowNo significant impact on patients

None

Ris

k (&

rig

or of a

pproac

h)

1

2

3

Spreadsheet Components

Application (code, e.g. VBA)

Data

(sheets)

Package (Product)

20

Conclusions

• Validation effort should be commensurate with GxP risk and complexity

“Is this use of spreadsheets risking GxP record integrity or product quality?“

“Are appropriate controls applied to manage the GxP risk?”

22

Sion Wyn

Conformity

+[44] (0) 1492 642622

sion.wyn@conform-it.com